About Gong

At Gong, we’re transforming customer-facing teams with our AI-powered platform that understands conversations, guides sales professionals, and drives better business outcomes. Security and trust are foundational to everything we build.

As a Senior Product Security Engineer, you will help shape how security is built, not just how it is tested or reviewed. You’ll work closely with engineering teams to secure real systems in production, influencing how services, APIs, and data flows are implemented from the ground up.

This is a hands-on role, focused on solving real security problems across cloud-native architectures and AI-driven features. You’ll work directly with developers and DevOps, dive into systems when needed, and apply strong technical judgment to ensure security is built into the product, not added later.

What Makes This Role Unique at Gong

• A product where data sensitivity is real, not theoretical
  Gong processes and analyzes customer conversations at scale, creating unique challenges around data protection, privacy, and access control.
• AI is deeply embedded in the product
  Security challenges extend beyond traditional AppSec into data handling, model behavior, and misuse scenarios.
• Security is part of how we build, not a layer on top
  The role operates within engineering workflows, focusing on building secure systems rather than enforcing external controls.
• Meaningful scale and real production impact
  You’ll work on systems that handle large volumes of data and traffic, where security decisions directly affect reliability and trust.
• A culture that values practical, engineering-driven security
  The focus is on solving real problems and enabling teams, not on process-heavy or compliance-driven approaches.
• High ownership with room to grow
  You’ll have the autonomy to take initiative, drive improvements, and expand your impact as the platform evolves.

What You’ll Do

• Secure real product flows end-to-end - Work directly with engineers to identify and fix vulnerabilities across services, APIs, and data paths in production systems
• Drive secure-by-design practices in engineering - provide practical guidance on authentication, authorization, data protection, and service-to-service communication
• Secure cloud-native environments - strengthen identity (IAM), isolation, and access control across Kubernetes, containers, and cloud infrastructure
• Build and scale security in the development lifecycle - integrate and tune security tooling (SAST, SCA, IaC scanning, secrets detection) into CI/CD pipelines to improve signal and developer adoption
• Own vulnerability management as a system - prioritize risks, drive remediation with engineering teams, and eliminate recurring issues through root-cause fixes
• Strengthen software supply chain security - reduce risk across dependencies, third-party components, and build/release pipelines
• Secure AI/ML-driven features - partner with data and AI teams to mitigate risks such as data exposure, misuse, and model-related vulnerabilities
• Raise the security bar across engineering - mentor developers and help teams take ownership of security in their code and services
• Enable fast, informed decisions - clearly communicate risks and trade-offs to support product and engineering velocity

What You Bring

• 5+ years of experience in Product Security, Application Security, or a similar hands-on security engineering role
• Proven experience working closely with engineering teams on real systems in production, not just assessments
• Strong understanding of secure design and threat modeling, with the ability to influence architecture decisions
• Deep knowledge of application security principles (OWASP Top 10 and beyond), including modern attack vectors
• Hands-on experience securing web applications, APIs, and distributed systems
• Strong experience with cloud environments (AWS, GCP, and/or Azure), including identity and access management (IAM)
• Familiarity with Kubernetes, containers, and cloud-native architectures
• Experience integrating security into CI/CD pipelines and improving developer workflows
• Practical experience with security tooling (SAST, SCA, IaC scanning, secrets detection), including tuning and operationalizing
• Experience working with modern development stacks (e.g., Java, Python, JavaScript/TypeScript, React or similar)
• Strong problem-solving skills and the ability to analyze complex systems and prioritize meaningful risks
• Ability to influence developers through technical credibility and practical guidance
• Experience mentoring engineers and improving security practices across teams

Additional strengths:

• Experience securing AI/ML or LLM-based systems
• Background in offensive security/penetration testing

About Gong

At Gong, we’re transforming customer-facing teams with our AI-powered platform that understands conversations, guides sales professionals, and drives better business outcomes. Security and trust are foundational to everything we build.

As a Product Security Architect, you will shape how security is built, not just review it. You’ll work closely with engineering to influence architecture, guide design decisions, and ensure security is embedded across Gong’s platform from the earliest stages where decisions matter most, not just where they are validated. You’ll take on complex, real-world challenges across cloud-native systems and AI-driven features, where security must evolve alongside scale and speed. This role is not about checklists or gatekeeping, but about applying strong technical judgment, making pragmatic trade-offs, and enabling teams to build secure systems by design. If you’re looking to have a meaningful impact on a real product, collaborate with high-caliber engineering teams, and help define modern product security at scale, you’ll find this role both challenging and rewarding.

What Makes This Role Unique at Gong

• A product where security decisions truly matter - Gong processes and analyzes highly sensitive customer conversations at scale, creating unique challenges around data protection, privacy, and trust.
• AI is core to the product, not a side project - You’ll work in an environment where AI/ML is deeply embedded, addressing real-world security challenges that go beyond traditional application security.
• A platform operating at a meaningful scale -  You’ll deal with high-volume data, distributed systems, and production environments where security decisions have immediate and visible impact.
• The opportunity to shape a growing security domain -  Product security at Gong is still evolving, giving you the ability to influence direction, introduce new ideas, and build things the right way.
• A culture that values practical, engineering-driven security - Security is approached with a focus on real risk and practical solutions, not just compliance or process.
• High ownership with room to grow - You’ll have the autonomy to take initiative, drive changes, and expand your impact as the company and platform continue to scale.

What You’ll Do

• Shape security architecture where it matters most, partner with engineers early in the design phase to influence system architecture, define secure patterns, and make critical decisions before code is written
• Work hands-on with engineering teams to secure real systems  review designs, dive into code and PRs when needed, and build small tools or proofs-of-concept to validate security assumptions
• Lead threat modeling and deep design reviews  identify trust boundaries, abuse cases, and high-impact attack paths, and ensure controls hold up in real production environments
• Own security design for authentication, authorization, and APIs, including identity flows (OAuth/OIDC), session management, and multi-tenant access control
• Take ownership of complex security challenges across cloud-native, distributed, and AI-driven systems, where trade-offs are not obvious and solutions require both depth and pragmatism
• Drive secure-by-design practices at scale, build guardrails, reusable patterns, and reference architectures that make secure implementation the default
• Secure AI/ML features in production  address risks such as prompt injection, data poisoning, model misuse, and data exposure in collaboration with AI teams
• Strengthen the software supply chain and CI/CD security to improve how dependencies, build pipelines, and artifacts are secured and validated
• Embed security into developer workflows, integrate SAST, DAST, SCA, IaC scanning, and secrets detection in a way that is effective and adopted
• Partner on high-severity vulnerabilities and incidents to drive root cause analysis, remediation, and long-term fixes that improve system resilience
• Raise the security bar across engineering  mentor developers, influence design culture, and drive strong ownership of security

What You Bring

• 8+ years of experience in Product Security, Application Security, or Security Architecture
• Strong software engineering foundation with the ability to read code (e.g., Java, Python, JavaScript/TypeScript, React or similar), review PRs, and understand systems end-to-end.
• Deep understanding of application security principles (OWASP Top 10, secure design, common vulnerability classes)
• Experience securing cloud-native SaaS environments (AWS, GCP, and/or Azure), including containers and Kubernetes
• Strong knowledge of authentication and authorization systems, including OAuth2, OIDC, SAML, and secure API design
• Hands-on experience integrating security into CI/CD pipelines and developer workflows (SAST, DAST, SCA, secrets, IaC scanning)

• Experience with threat modeling and risk assessment methodologies
• Ability to analyze vulnerabilities end-to-end  from code to architecture to production impact
• Strong communication skills and ability to influence engineering decisions without authority

Additional strengths:

• Ability to work closely with developers and influence engineering decisions
• Strong communication skills with both technical and business stakeholders
• A pragmatic approach balancing security, usability, and speed

Advantages:

• Experience securing AI/ML or LLM-based systems
• Experience with software supply chain security
• Experience in high-scale SaaS environments

We aren’t looking for a dashboard-watcher; we need a Digital Architect of Chaos-Prevention who treats zero-days like morning coffee and builds automated fortresses before a threat even breaks a sweat. As our Senior Security Operations Engineer, you’re the lead mechanic of our invisible shield, welding code and hardening global infrastructure until it’s more secure.

If you’re a cloud-savvy defender who thrives when the stakes are high and hates manual toil, your new playground is ready.

What You’ll Actually Do:

• Chaos Wrangler: Orchestrate SIEM/SOAR tools like a digital Mozart. Help the analysts out by automating the boring tasks
• ThreatBuster: Proactively look for threats that haven’t even decided to move in yet. You’re not just reacting; you’re predicting!
• Trap Setter: You don’t wait for an antivirus to beep. You build custom logic, YARA rules, and Sigma signatures that catch attackers before they realize they’ve been spotted.
• Master the Multi-Cloud: AWS, GCP, Azure—you’re the gatekeeper of our cloud kingdom, ensuring our posture is tighter than a drum across every environment.
• Fortune Teller: You spend time in the dark corners of the web, so we don’t have to. You ingest feeds, analyze adversary actions, and turn exploit rumors into actionable defense strategies
• The Elite Mentor: You’re the leader the pack looks to. You’ll level up our junior analysts/engineers and set the gold standard during on-call rotations.
• The Cross-Functional Diplomat: You’ll bridge the gap among IT, DevOps, and Privacy, closing security gaps and ensuring the entire org is as resilient as the tech it uses.
• Total Autonomy: We don't micromanage; we empower. You see a gap? You fix it. Do you see a process that can be automated? You build it.

Required Qualification:

• 5+ years of experience in any of the following areas:
• Security Data Pipeline Engineering
• Detection Engineering
• SIEM Engineering
• Cyber Intelligence and Threat Hunting
• Security Platform Engineering
• Proficiency with EDR/XDR (CrowdStrike, SentinelOne, MS Defender), Cloud Security Posture Management (Wiz, Prisma Cloud, Orca), and WAFs (Cloudflare, Akamai).
• Experience building data ingestion pipelines using CI/CD methodologies.
• Proven experience building, testing, and tuning custom detection logic and familiarity with Query Languages (KQL, SQL, SPL) for automation needs.
• Familiarity with attack frameworks (MITRE ATT&CK)  and mitigation strategies.
• Strong analytical and problem-solving skills.
• Excellent communication and teamwork abilities.

Preferred Qualifications:

• Security certifications like GXPN, GCIA, GCTI, GCDA, or similar are a plus.
• Experience architecting stateful automation pipelines using Python, Go, and enterprise SOAR platforms
• Ability to read/audit Terraform, Pulumo, or CloudFormation, and experience with Infrastructure as a code(IaC)
• Experience with securing and monitoring containers within cloud environments 

What makes Security at Gong unique?

Here at Gong, we trust and empower our employees with ownership to solve complex problems, make the right decisions, and build the best products that create radical impact. We call it “Own. Solve. Impact.” 

Our security team is at the forefront of a monumental shift in how we implement processes. Instead of simply saying "no," we embrace the mindset of "let's explore how we can make it work." Our security team brings a wealth of backgrounds, experience, and wisdom to the table. Which means that age comes before security, or is it the other way around?

If you are curious to discover Gong's wonderful and challenging world, what are you waiting for? Don’t delay - fill in your application details. Who knows, maybe there’s a Gongster in you!

PERKS & BENEFITS 

• We offer Gongsters a variety of medical, dental, and vision plans, designed to fit you and your family’s needs.
• Wellbeing Fund - flexible wellness stipend to support a healthy lifestyle.
• Mental Health benefits with covered therapy and coaching.
• 401(k) program to help you invest in your future.
• Education & learning stipend for personal growth and development.
• Flexible vacation time to promote a healthy work-life blend.
• Paid parental leave to support you and your family.
• Company-wide recharge days each quarter.
• Work from home stipend to help you succeed in a remote environment.

The annual salary hiring range for this position is $234,000 - $335,000 USD. 

Compensation is based on factors unique to each candidate, including, but not limited to, job-related skills, qualification, education, experience, and location. At Gong, we have a location-based compensation structure, which means there may be a different range for candidates in other locations. The total compensation package for this position, in addition to base compensation, may include incentive compensation, bonus, equity, and benefits. Some of our sales compensation programs also offer the potential to achieve above targeted earnings for those who exceed their sales targets. 

We are always looking for outstanding Gongsters! So if this sounds like something that interests you regardless of compensation, please reach out. We may have more roles for you to consider and would love to connect.

We have noticed a rise in recruiting impersonations across the industry, where scammers attempt to access candidates' personal and financial information through fake interviews and offers. All Gong recruiting email communications will always come from the @gong.io domain. Any outreach claiming to be from Gong via other sources should be ignored.

Gong is an equal-opportunity employer. We believe that diversity is integral to our success, and do not discriminate based on race, color, religion, age, sex, sexual orientation, gender identity, national origin, disability, military status, genetic information, or any other basis protected by applicable law.

To review Gong's privacy policy, visit https://www.gong.io/gong-io-job-candidates-privacy-notice/ for more details.

#LI-SM1